PostgreSQL Database ingress traffic should be restricted to specified IP addresses
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Description
Ensure that no PostgreSQL Databases allow ingress from 0.0.0.0/0 (ANY IP).
Rationale
PostgreSQL Server includes a firewall to block access to unauthorized connections. More granular IP addresses can be defined by referencing the range of addresses available from specific datacenters.
Impact
Disabling Allow access to Azure Services will break all connections to PostgreSQL server and Hosted Databases unless custom IP specific rules are not added in Firewall Policy.
From the console
- Go to PostgreSQL servers
- For each PostgreSQL server, click on Firewall / Virtual Networks
- Set Allow access to Azure services to
OFF - Set firewall rules to limit access to only authorized connections
Using PowerShell
Disable default firewall rule “Allow access to Azure services”:
Remove-AzPostgreSqlFirewallRule -Name "AllowAllWindowsAzureIps" -ResourceGroupName <resource group name> -ServerName <server name>
Remove custom firewall rule:
Remove-AzPostgreSqlFirewallRule -Name <name> -ResourceGroupName <resource group name> -ServerName <server name>
Set the appropriate firewall rules:
New-AzPostgreSqlFirewallRule -Name "<rule name>" -ResourceGroupName "<resource group name>" -ServerName "<server name>" -EndIPAddress "<IP Address other than 0.0.0.0>" -StartIPAddress "<IP Address other than 0.0.0.0 or 255.255.255.255>"
References
- https://docs.microsoft.com/en-us/azure/postgresql/concepts-firewall-rules
